jQuery Validate 1.6.0 Demo Code Advisory

±---------------------------------------------+
ADVISORY – jQuery Validate 1.6.0 Demo Code

AFFECTED PACKAGES
> jQuery Validate 1.6.0
> SilverStripe 2.3.X to 2.3.5

Discovered By CodeScan.com
±---------------------------------------------+

Vendor's Website:
http://bassistance.de/jquery-plugins/jquery-plugin-validation/

CodeScan Labs (www.codescan.com), has recently
released a new source code scanning tool,
CodeScan. CodeScan is an advanced auditing tool
designed to check web application source code
for security vulnerabilities. CodeScan utilises
an intelligent source code parsing engine,
traversing execution paths and tracking the flow
of user supplied input.

During the ongoing testing of CodeScan PHP, the
jQuery.Validate demonstration code was discovered
within another project.

<<< CROSS SITE SCRIPTING THROUGH ECHO >>>

XSS in [form.php], folder [demo].
(Full Path:

$user = $_REQUEST['user'];
$pw = $_REQUEST['password'];
if($user && $pw && $pw == "foobar")
echo "Hi $user, welcome back."

<<< PROOF OF CONCEPT >>>

http://[host]/validate/demo/form.php?user=%3Cscript%3Ealert%28%27Proof%20of%20Concept%27%29;%3C/script%3E&password=foobar

<<< YES, WE REALISE THIS IS DEMO CODE >>>

A simple Google search unearthed a number of
results for the existence of this plugin/demo
within SVN repositories, as well as on live web
servers. Demo or not, it has been included in
distributions (Such as SilverStripe) – and has
been deployed in live environments.

<<< RESPONSIBLE DISCLOSURE >>>

We have attempted to make contact with the
author of this plugin, to no avail.

We successfully made contact with the
SilverStripe team who promptly tidied up.
Quick response, well done.

<<< EXPLICIT RECCOMENDATIONS >>>

SilverStripe Users: Upgrade to the latest
version of SilverStripe (2.3.6 at time of
writing), and ensure the file is deleted.

Other Users: Chances are you do not need
this file in your project, so delete the
[form.php] file. Otherwise, ensure proper
Sanitization.

<<< CLOSING NOTES >>>

You may be able to write secure code, but the
code you get from third parties can put you at
risk. Always review the code of third parties
(including/especially plug ins) – not doing so
puts you at unnecessary risk.

–

This message has been scanned for viruses and

dangerous content by Bizo EmailFilter, and is

believed to be clean.